11 matches found
CVE-2026-46454
camel-cometd Inbound Bayeux Header Injection Reproducer CVE-2026-46454 This project demonstrates a message-header injection in Apache Camel's camel-cometd component, tracked as CVE-2026-46454. The component maps inbound Bayeux CometD message headers into the Camel Exchange without...
Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...
GHSA-R9CC-J7WR-P329 Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...
CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...
CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...
CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...
CVE-2026-46454
The Apache Camel Cometd Component suffers from an improper input validation vulnerability (CWE-20) where it fails to apply a HeaderFilterStrategy when mapping inbound Bayeux (CometD) message headers into the Camel Exchange. Specifically, the CometdBinding.populateExchangeFromMessage (or createCam...
PT-2026-55889
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description Improper input validation in the Apache Camel Cometd component allows unauthenticated users to injec...
com.cisco.oss.foundation:http-server-jetty-8 (>=0.0.0-6, <=1.0.2-2), net.osgiliath.framework:net.osgiliath.features.karaf-features-camel (>=0.1.2, <=0.1.5) +14 more potentially affected by CVE-2021-28169 via org.eclipse.jetty:jetty-servlets (8.1.15.v20140411)
org.eclipse.jetty:jetty-servlets MAVEN version 8.1.15.v20140411 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-servlets and may be impacted: - com.cisco.oss.foundation:http-server-jetty-8 =0.0.0-6, =0.1.2, =2.14.0, =2.14.0,...
org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2017-7658 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)
org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...
org.apache.camel:camel-cometd (>=2.9.0-rc1, <=2.9.0), org.apache.camel:camel-example-cxf (>=2.9.0-rc1, <=2.9.0) +109 more potentially affected by CVE-2017-9735 via org.eclipse.jetty:jetty-server (7.5.3.v20111011)
org.eclipse.jetty:jetty-server MAVEN version 7.5.3.v20111011 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.camel:camel-cometd =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1, =2.9.0-rc1,...